Is Sweezy Custom Progress Bar for Youtube™ safe?
Sweezy Custom Progress Bar is medium risk. Opening this extension's popup or its progress-bar controls POSTs to GA4 with a persistent install UUID that never rotates. Testing saw the same UUID across separate popup loads. The GA4 secret is base64-encoded in the source.
Who publishes itSweezy - 2 other listings from the same operator, 1 of them carrying a finding
Sweezy - 2 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 130k+ users between them. 1 of them carries a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Popup telemetry ties a persistent UUID to every YouTube progress-bar interaction
Opening this extension's popup or its progress-bar controls POSTs to GA4 with a persistent install UUID that never rotates.
Testing saw the same UUID across separate popup loads.
The GA4 secret is base64-encoded in the source.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open the extension popup or interact with a progress bar control.
Actions include: opening the popup, selecting a progress bar style, applying a custom color, or adding a new custom bar.
The popup sends a POST to Google Analytics 4 with a UUID that was created on install and never changes.
The event payload includes your persistent client_id, a session_id, the event name, and the page title.
204 No Content, GA4 accepted the event; no body returned.
- Content-Type
- application/json
{ "client_id": "fd8f8ee7-0c0a-445a-97f3-6263cee0a156", "events": [ { "name": "page_view", "params": { "session_id": "1749168000000", "engagement_time_msec": 100, "language": "en-US", "page_location": "/popup.html", "page_title": "YouTube Progress Bar Popup" } } ]}- Install-time UUIDfd8f8ee7-0c0a-445a-97f3-6263cee0a156
A unique identifier generated at install and stored permanently. It lets the developer recognize your browser across every popup session.
- Session ID1749168000000
A timestamp-based ID that groups events within a 12-hour window. Resets after 12 hours of inactivity.
- Event nameprogress_bar_selected
The specific interaction you performed, opening the popup, selecting a bar style, applying a custom color, or adding a new bar.
- Page titleYouTube Progress Bar Popup
The title of the popup page at the time of the event, confirming which popup view was open.
The GA4 API credential is embedded in the extension source as a base64 string rather than fetched from a server. This makes it recoverable by anyone who inspects the extension files.
OzUB5btcQyO7OvimX0SddwGA4 telemetry function in popup.bundle.js (lines 20898-20955)
// popup.bundle.js:20898 — GA4 API secret (base64-obfuscated)const rr = atob("T3pVQjVidGNReU83T3ZpbVgwU2Rkdw==");// Decodes to: OzUB5btcQyO7OvimX0Sddw// popup.bundle.js:20929–20955 — sendAnalyticsEvent(name, params)const or = ({ name: e, params: t }) => (async () => { // Retrieve persistent UUID from chrome.storage.local key 'configuration.clientId' const clientId = await (async () => (await er.get()).clientId)(); // Build or reuse session_id (12-hour TTL) const sessionId = await (async () => { const store = chrome.storage.session ? new Ar(chrome.storage.session) : new Ar(Yn); let session = await store.getSessionData(); const now = Date.now(); if (session?.timestamp && (now - Number(session.timestamp)) / 60000 <= 43200) { session.timestamp = now.toString(); await store.setSessionData(session); return session.session_id; } session = { session_id: now.toString(), timestamp: now.toString() }; await store.setSessionData(session); return session.session_id; })(); const event = { name: e, params: { session_id: sessionId, engagement_time_msec: 100, language: navigator.language, page_location: location?.pathname, ...t, }, }; try { await fetch( `https://www.google-analytics.com/mp/collect?measurement_id=G-H20C76D7M5&api_secret=${rr}`, { method: "POST", body: JSON.stringify({ client_id: clientId, events: [event] }), } ); } catch {} })();// Call sites:// popup.bundle.js:37099 — fired on popup open: or({ name: 'page_view', params: { page_title: document.title } })// popup.bundle.js:36924 — fired on bar select: or({ name: 'progress_bar_selected', params: { progress_bar_id, progress_bar_name } })// popup.bundle.js:34013 — fired on color pick: or({ name: 'custom_color_used', params: { progress_bar_id, progress_bar_name } })// popup.bundle.js:36966 — fired on bar added: or({ name: 'customized_bar_added', params: { progress_bar_id, progress_bar_name } })- www.google-analytics.com
Google Analytics 4 (Measurement Protocol). Receives the persistent client UUID, session ID, event name, and page title on every popup open and interaction.
What it can do
Permissions this extension asks for, as declared in version 3.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on youtube.com
*://*.youtube.com/*
Store data in your browser
storage
Run its own code inside the pages you visit
scripting